fixing up pam_http

.gitignore

@@ -164,3 +164,5 @@
 /udsService/udsgui/obj/Debug
 /udsService/udsgui/obj/Release
 /udsService/udsgui/obj/x86
+
+.vscode

ssh-tunnel/pam-http/src/http.c

@@ -1,6 +1,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <ctype.h>
 
 #include <curl/curl.h>
 #include <curl/easy.h>
@@ -62,12 +63,28 @@ static int getUrl(const char* url, char* buffer, size_t size ) {
   
 }
 
+int isValid(const char* str) 
+{
+  const int len = strnlen(str, 256);
+  for( int i = 0; i < len; i++ ) {
+    if ( !isalnum(str[i] && str[i] != '-') ) {
+      return 0;
+    }
+  }
+  return 1;
+}
+ 
 int httpAuthenticate(const char* username, const char* password, const char* authHost)
 {
   char* buffer = malloc(DATASIZE);
   char* url = malloc(256);
   int res;
   
+  /* Ensure username & passwords are valid */
+  if (!isValid(username) || !isValid(password)) {
+    return -1; /* no valid data, injecting? */
+  }
+
   sprintf( url, "%s?%s=%s&%s=%s", authHost, AUTHID, username, AUTHPASS, password );
   res = getUrl( url, buffer, DATASIZE );
   free(url);

ssh-tunnel/pam-http/src/passwd.c

@@ -14,6 +14,8 @@
 
 #include <syslog.h>
 
+#include "http.h"
+
 char baseUrl[256] = { '\0' };
 
 enum nss_status _nss_uds_getpwuid_r(uid_t,struct passwd *,char *, size_t,int *);